{"id":119440,"date":"2024-08-13T15:43:13","date_gmt":"2024-08-13T13:43:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0"},"modified":"2024-08-13T15:43:13","modified_gmt":"2024-08-13T13:43:15","slug":"uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","title":{"rendered":"Vulnerabilit\u00e0 nei browser web che consente di attaccare servizi locali tramite IP 0.0.0.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

L'azienda Oligo Security ha pubblicato informazioni su una vulnerabilit\u00e0 che colpisce Chrome, Firefox e Safari, consentendo di aggirare le restrizioni di accesso ai servizi di rete disponibili solo sul sistema locale, attraverso una richiesta all'indirizzo IP 0.0.0.0. I primi avvisi riguardo a questa vulnerabilit\u00e0 sono stati pubblicati ben 18 anni fa, ma il problema non \u00e8 ancora stato risolto. <\/p>\n

La vulnerabilit\u00e0, che si manifesta solo su Linux e macOS, \u00e8 causata dal fatto che l'indirizzo IP 0.0.0.0 su queste piattaforme porta a contattare l'interfaccia di rete locale (localhost), ovvero l'invio di una richiesta a 0.0.0.0 \u00e8 analogo a fare una richiesta all'indirizzo 127.0.0.1. Nei moderni browser sono presenti meccanismi per contrastare l'accesso a 127.0.0.1 quando si naviga su siti esterni, poich\u00e9 potrebbe essere utilizzato per manovre sui servizi interni del sistema dell'utente, accessibili solo ad applicazioni locali. <\/p>\n

L'attraversamento dell'host consente di bypassare il divieto di accesso a 127.0.0.1 e di organizzare un attacco ai servizi interni aprendo una pagina esterna controllata dall'attaccante nel browser. Accedendo tramite 0.0.0.0, i meccanismi CORS (Cross-Origin Resource Sharing) e PNA (Private Network Access) non possono ostacolare un simile attacco. \u00c8 importante notare che il problema non \u00e8 cos\u00ec banale come sembra e gi\u00e0 viene sfruttato da malintenzionati per condurre attacchi reali che sfruttano vulnerabilit\u00e0 critiche in applicazioni server accessibili solo per il sistema locale.

\"Vulnerabilit\u00e0\"Vulnerabilit\u00e0<\/center> <\/p>\n

Ad esempio, l'utilizzo di 0.0.0.0 per accedere ai servizi locali \u00e8 stato registrato negli attacchi ShadowRay e Selenium Grid identificati a marzo e luglio, utilizzati per eseguire codice sui sistemi degli sviluppatori. Nel caso dell'attacco ShadowRay, l'obiettivo erano i sistemi degli sviluppatori che usano il framework AI Ray. Il secondo attacco mirava a sfruttare una vulnerabilit\u00e0 critica nella piattaforma Selenium Grid in configurazioni che accettano richieste solo dal host locale. <\/p>\n

Inoltre, viene menzionata la possibilit\u00e0 di applicare il metodo per sfruttare la vulnerabilit\u00e0 ShellTorch in server<\/a> PyTorch TorchServe, utilizzato sui computer degli sviluppatori di applicazioni AI. L'accesso ai servizi di rete dell'host locale pu\u00f2 anche essere utilizzato per la scansione delle porte di rete per identificare indirettamente l'utente. <\/p>\n

Gli sviluppatori di Firefox hanno preparato una modifica alla specifica per la chiamata Fetch, vietando l'accesso a 0.0.0.0, ma non hanno ancora definito una data per l'inizio del blocco nel browser. In Chrome, l'accesso a 0.0.0.0 \u00e8 previsto per essere bloccato nella versione Chrome 128, attesa per la prossima settimana. In Safari, il blocco di 0.0.0.0 \u00e8 previsto per essere implementato nella versione Safari 18.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Oligo Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Chrome, Firefox \u0438 Safari, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0443 0.0.0.0. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0435\u0449\u0451 18 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u043d\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a \u0438 \u043d\u0435 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":119441,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119440","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 nei web browser che consente di attaccare servizi locali tramite IP 0.0.0.0 | ProHoster","description":"L'azienda Oligo Security ha pubblicato informazioni su una vulnerabilit\u00e0 che interessa Chrome, Firefox e Safari, e che permette di aggirare la restrizione di accesso ai servizi di rete accessibili solo sul sistema locale, tramite la connessione all'indirizzo IP 0.0.0.0. I primi avvisi sulla vulnerabilit\u00e0 sono stati pubblicati gi\u00e0 18 anni fa, ma il problema non \u00e8 stato ancora risolto. La vulnerabilit\u00e0 si manifesta solo in","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 web-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0447\u0435\u0440\u0435\u0437 IP 0.0.0.0 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Oligo Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Chrome, Firefox \u0438 Safari, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u043b\u0443\u0436\u0431\u0430\u043c, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043f\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0443 0.0.0.0. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0435\u0449\u0451 18 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434, \u043d\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a \u0438 \u043d\u0435 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-web-brauzerah-pozvolyayushhaya-atakovat-lokalnye-servisy-cherez-ip-0-0-0-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-13T13:43:15+00:00","article:modified_time":"2024-08-13T13:43:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119440","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:01:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:52:19","updated":"2026-02-09 22:01:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/119440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=119440"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/119440\/revisions"}],"predecessor-version":[{"id":160058,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/119440\/revisions\/160058"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/119441"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=119440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=119440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=119440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}